Commercial refrigeration: when the monitoring system itself is compromised

On 12 October 2026, France's CERT-FR published an alert (CERTFR-2026-ALE-012) about a security incident targeting Danfoss AK-SM and AK-SC series supervisors. These devices run the refrigeration systems of supermarkets, warehouses and cold rooms. The agency says it is aware of numerous compromises.

What we know

• The targeted devices are supervisors: they centralise a site's controllers, their setpoints, alarms and defrost schedules. Taking control of one means acting on all the refrigeration of a site.
• CERT-FR considers exposing their management interface to the Internet contrary to good practice, and recommends disconnecting them or filtering access.
• A France 3 Occitanie report describes a cyberattack on equipment from the manufacturer Dixell at a Leclerc hypermarket in the Tarn, which lost refrigeration.

What we don't know yet

The alert gives neither the number of victims, nor their sector, nor the attack method, nor the vulnerability exploited. These incidents should therefore not be attributed to any particular flaw: an exposed interface with a weak or default password can be enough.

What research had already shown

In August 2026, Claroty's Team82 published two studies on widely deployed refrigeration supervisors. The manufacturers have fixed the flaws described.

• Danfoss AK-SM 800A: a hidden code-of-the-day mechanism, computable from the device's date alone, gave administrator access on vulnerable versions without knowing the configured password. The researchers counted 2,765 interfaces exposed to the Internet, not all of them vulnerable. Fix: firmware R4.3.1.
• Copeland XWEB Pro (Dixell brand): 23 vulnerabilities. On their test bench, the researchers controlled cooling and changed the temperature displayed by the connected controller. Fix: firmware 1.13.

The real risk: a screen that says everything is fine

A compromised supervisor can throw the installation off while displaying normal values. And alarms often go out from the same device: if it is compromised, they may never arrive. The system meant to warn you then becomes part of the problem.

Steps to take with your refrigeration contractor and your IT lead

• Inventory and secure the equipment: apply vendor updates, review accounts, remove default passwords.
• Protect access: no supervisor directly exposed to the Internet, remote maintenance through a secure VPN, a refrigeration network separated from the office network with filtered traffic.
• Monitor configurations: keep a verified baseline and trigger a check whenever setpoints, defrost or alarm settings change without explanation.
• Add an independent temperature measurement, with transmission and alerting kept separate from the controller, and an alert when the sensor stops reporting.

If you suspect a Danfoss AK-SM or AK-SC device has been compromised, CERT-FR recommends restricting network access to service providers only, resetting the device to factory settings, applying updates, renewing secrets, reviewing existing accounts and then fully reconfiguring the device.

Our view

A supervisor should not be your only proof that refrigeration is under control. Two independent readings that diverge abnormally call for a check. It is not necessarily a cyberattack, but it is a signal to take seriously.

Marfik Industry supports operators and refrigeration contractors on these issues: inventory of connected equipment, network separation, independent temperature sensors with their own alerting chain.